Jurisdiction Coverage Map

Consenti ships an embedded map of 211 countries and territories, each pre-assigned to one of the 8 built-in compliance groups — the model that decides opt-in vs. opt-out behaviour, GPC handling, and legitimate-interest rules. It's the reference for the type field in UI / Backend configuration, and for the compliance array shown on every compliance guide.

Compliance Groups

1. Standard Opt-in (GDPR) — opt-in

   GDPR / ePrivacy style: prior consent required before non-essential cookies. Granular consent, easy reject, easy withdrawal.

2. Opt-out (US State Laws) — opt-out

   US state privacy laws. Collect first, allow opt-out of sale/share. Covers CCPA and all state-level equivalents.

3. Opt-out Strict (CPRA / California) — opt-out-strict

   California CPRA: opt-out with sale/sharing/sensitive categories required. GPC must be honored. Stricter than general US state laws.

4. Opt-in (India DPDPA) — opt-in-dpdpa

   India's Digital Personal Data Protection Act. Opt-in consent with data fiduciary disclosure. No legitimate interest basis.

5. Opt-in (China PIPL / DSL) — opt-in-china

   China PIPL + DSL + CSL: strict opt-in with purpose specification, data minimisation, and cross-border transfer controls.

6. Opt-in (Brazil LGPD) — opt-in-brazil

   Brazil LGPD: opt-in consent required. Legitimate interest is a valid basis. Analytics and advertising may differ in treatment.

7. General Privacy Consent — general-privacy-consent

   Privacy notice or consent rules exist but the jurisdiction does not have a GDPR/PECR-style strict cookie banner law. Documenting legal basis is best practice.

8. Notice Only — notice-only

   A privacy notice is generally sufficient. No dedicated cookie banner law is encoded for this jurisdiction.

9. Custom compliance groups

   The 8 groups above cover every country in the map, but a profile is not limited to them. Every profile has an optional customComplianceGroup field — a free-form, lower-kebab-case string that stands in for complianceGroup when a site needs a consent model that doesn't map to any built-in group (a bespoke internal policy, a jurisdiction not yet in the map, an A/B test variant, etc.).

   Aspect	Behaviour
   Where it's set	Admin dashboard profile wizard, Step 1 — choose None / Custom instead of one of the 8 built-in radio options, then type the identifier. See the Admin Dashboard guide.
   How it's targeted	Set the widget's compliance.type to the same string. Consenti resolves it exactly like a built-in group, fetching whichever profile is active for that name.
   Requirement	API mode only (api.enabled: true). There is no pre-built/offline fallback for a custom group name — resolution throws if nothing is active for it server-side.
   Validation	None of the COMPLIANCE_VALIDATION_RULES (legal-basis requirements, GPC recommendations, CPRA categories) apply to a custom group — you own correctness.

   💡A related but distinct mechanism: instead of a new custom group, you can also override one of the 8 built-in groups everywhere it's resolved — geo-detected or fixed — by registering a ConsentiProfile with a matching complianceGroup (optionally deepMerge: true to patch instead of replace). See Overriding a built-in compliance group.

Jurisdiction Coverage Map

Click a column header to sort.

Regional overrides

Some countries route sub-nationally instead of by country alone — most notably the United States (state-level laws) and Canada (Quebec's Law 25). When a resolver returns a region, Consenti checks this table before falling back to the country's base group above.

Supported locales

188 locale codes appear across the map above (BCP 47, e.g. fr-CA, zh-CN). A profile's translations map can use any of these — or any locale at all; the map only reflects what each country typically needs. Resolution order at runtime: exact locale match → language prefix → defaultLocale.